Prevent malformed DNS queries executing JS on querylog/long term query pages #1665
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
PromoFaux
force-pushed
the
fix/escape-all-the-things
branch
2 times, most recently
from
c568d05
to
d6f7955
Compare
DL6ER
reviewed
Dec 23, 2020
PromoFaux
force-pushed
the
fix/escape-all-the-things
branch
from
d6f7955
to
9744f86
Compare
…y log Signed-off-by: Adam Warner <me@adamwarner.co.uk>
PromoFaux
force-pushed
the
fix/escape-all-the-things
branch
from
9744f86
to
d85395c
Compare
Signed-off-by: Adam Warner <me@adamwarner.co.uk>
PromoFaux
force-pushed
the
fix/escape-all-the-things
branch
from
d85395c
to
62ac184
Compare
DL6ER
approved these changes
Dec 23, 2020
Merged
|
This pull request has been mentioned on Pi-hole Userspace. There might be relevant details there: https://discourse.pi-hole.net/t/pi-hole-core-web-v5-2-2-and-ftl-v5-3-3-released/41998/1 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
By submitting this pull request, I confirm the following:
git rebase)What does this PR aim to accomplish?:
Fixes a potential vulnerability in the querylog/long term query pages
How does this PR accomplish the above?:
Escapes any data retrieved from the database for these pages, thus preventing executable code being run
What documentation changes (if any) are needed to support this PR?:
None